Publish a public Trust Center that shows your compliance status, controls, policies, subprocessors and documents, and keep it current.

Trust Center setup

A Trust Center is a public page where customers and prospects check your security and compliance before they buy: the frameworks you meet, the controls you monitor, your policies and subprocessors, your audit outcome, and the documents you share. It is published at https://<slug>.trust.safeguard.sh, where <slug> is the public slug you choose.

You manage it on Compliance › Trust Center. If you do not see that tab, the Trust Center is not switched on for your workspace; ask your Safeguard administrator.

1. Create the page

On Compliance › Trust Center, choose one of two editors:

Edit Trust Center opens your real public page with Click any text to edit it: change text in place, then save.
Advanced settings opens the same content as a form, with everything the page has: logos, the coverage grid, contact details and which policies are listed.

The page settings are:

Setting	What it does
Public slug	The address of the page: `https://<slug>.trust.safeguard.sh`. Required.
Organization name	Shown at the top of the page. Required.
Headline and Description	A short line and two or three sentences under your name: what your company does and what the page reports.
Masthead links	Links shown beside your contact addresses, such as your privacy policy or status page. Each must start with `http://` or `https://`.
Brand color (hex) and Logo URL	Your colour and logo.
Security contact email and Privacy contact email	Shown in the page's contact section, for vulnerability reports and for data subject requests.

2. Publish it

In Advanced settings, turn on Publish Trust Center and save. When it is off, your public page returns 404. Publishing is always an explicit action: nothing goes live on its own, and new content such as a highlight starts as a draft.

Use View public page to open the live page. Changes you save appear on it; a framework's live readiness, below, updates within five minutes.

3. Choose what the page shows

Each section appears on the public page only when it has something in it.

Frameworks. Pick the frameworks to publish. Each shows one status: Compliant, In progress, Not assessed or Signed (see framework statuses).
Published controls. Pick the control areas to show. Each is read live from your continuous monitoring, so a control that starts failing shows as failing without you republishing. Only areas from frameworks you publish are listed, and an area appears once a compliance scan has evaluated it.
Published policies and Sub-processors. On your main Trust Center page these come from your policy and vendor registers whenever those have entries.
Coverage by offering. A grid of what each of your products covers. Until you set it up, the section does not appear.
Data collected. What personal data you hold, and what you do not. Saying no is a stronger answer than leaving a category out.
FAQ. The questions reviewers ask before they email you, shown in your order.
Updates. Dated posts, such as a new report or a framework achieved. The newest appears first.
Audit outcome. The auditor's opinion from a completed audit (see audit outcome).

Where they are switched on for your workspace, the page can also carry:

Quick summary: up to 12 short highlights at the top of the page, such as annual audits, penetration tests or a bug bounty, each with an optional icon, detail and https link. State only what is true today.
FAQ categories, such as Access Management, Encryption or Vendor Management.
Incidents and security advisories: an update can be an Announcement, an Incident or a Security advisory. An incident carries a status (Investigating, Identified, Monitoring, Resolved or Not affected) and a dated history shown under the post.
AI governance: the AI in your product, in your own words (the models, who makes them, where they run and how you govern them), published on the page's AI Governance tab.

Framework statuses

Status	Where it comes from
Compliant	Live readiness with every control in scope passing, a framework backed by a current audit report or certificate, or, for frameworks that allow it, your own self-assessment with its attestation date.
In progress	Live readiness with controls still failing, or a declared status.
Not assessed	Nothing backs a status yet.
Signed	A pledge you signed, such as the Secure by Design Pledge. It is never shown as Compliant.

A framework that needs an independent auditor or certification body cannot be declared compliant on a self-assessment: show its certification instead.

Publish live readiness. When your page shows a framework as Not assessed, you can publish its live readiness instead: the readiness score of your own controls (not an audit), shown as Compliant only when every control in scope passes. Choose Publish live readiness on that framework. The page updates within five minutes, and Stop publishing live readiness takes it back off.

Monitoring line. Once your continuous tests have completed a check, the page says Continuously monitored, last checked and when. Showing how many tests pass is opt-in; ask Safeguard support to turn it on.

Audit outcome

When an auditor records an issued opinion in the audit workspace, it appears under Audit outcome on Compliance › Trust Center. Publishing it shows the opinion type, the framework, the period and the auditor firm on your page. The signed report is listed as available on request and is released only through an approved access request.

Only a compliance reviewer or administrator can publish or take down an audit outcome. The page takes it down by itself when the auditor corrects the opinion or a certificate expires.

Documents

With access management on, the Documents section of the Trust Center lists what your page offers. Choose Add document and set:

a Category: Compliance report, Penetration test, Questionnaire, Policy, Privacy, Financial, Security or Other;
its Visibility: anyone can download a Public document, and only an approved viewer a Restricted one;
whether it appears On the public page.

Each file shows its size and SHA-256. Audit reports come from your audits; here they can only be shown on or hidden from the public page. A restricted document listed without a file shows to viewers as not yet available.

To share restricted documents, set up access requests.

Subscribers and updates

Visitors can Subscribe to updates on your page with their email address and are emailed when you publish a change, such as a new report, a policy update or a security incident. Where confirmed subscriptions are switched on, visitors choose their topics (Updates and announcements, Incidents and security advisories) and confirm by email before anything is sent.

Where security contacts are switched on, the Security contacts section lists the people your customers named to receive security notifications, such as a CISO or an incident response list. Your team can add contacts too. Notify about an update sends a published update to every security contact of the Trust Center by email; an email cannot be unsent.

Trust Center setup

On this page